Adopt the org CI

.github/rulesets/default.json

@@ -0,0 +1,41 @@
+{
+  "name": "default",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    { "type": "required_linear_history" },
+    { "type": "required_signatures" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": ["squash"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          { "context": "ci / flake-check", "integration_id": 15368 }
+        ]
+      }
+    }
+  ],
+  "bypass_actors": [
+    { "actor_id": null, "actor_type": "OrganizationAdmin", "bypass_mode": "pull_request" }
+  ]
+}

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+# Org standard CI: the external-systems/pkgs org-ci workflow. `nix flake
+# check` on PRs, the merge queue and main; on main, after it passes, the
+# docs/slides deploy to GitHub Pages and a 0.<minor>.<commits> release.
+#
+# Required status check for the ruleset: "ci / flake-check".
+#
+# Private flake inputs (e.g. external-systems/secrets): give the repo the
+# NIX_APP_ID + NIX_APP_PRIVATE_KEY org secrets and add
+# `private-repos: secrets` under `with:`.
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  merge_group:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  ci:
+    uses: external-systems/pkgs/.github/workflows/org-ci.yml@main
+    # The union org-ci's jobs need; each job narrows it to its own.
+    permissions:
+      contents: write
+      actions: write
+      pages: write
+      id-token: write
+    with:
+      # Release series x in 0.x.y.
+      minor: 0
+    secrets: inherit

CLAUDE.md

@@ -12,8 +12,9 @@ The website and deck are built in CI and published to GitHub Pages only.
 Never commit build output: no `result` / `result-*` links, no `_site/`,
 `site/` or `documentation/site/` (all gitignored), no built deck copied
 into the tree, no `gh-pages` branch pushes. To publish, merge to `main`;
-`.github/workflows/pages.yml` runs `nix flake check`, builds
-`.#documentation` (deck at `/slides/`) and deploys it.
+`.github/workflows/ci.yml` calls the org CI (external-systems/pkgs
+`org-ci.yml`): it runs `nix flake check`, builds `.#documentation` (deck
+at `/slides/`) and deploys it. Change CI only in pkgs, never here.
 
 ## Build and check
 

README.md

@@ -29,7 +29,7 @@ Remember to `git add` new files: Nix only sees files git tracks.
 
 Never commit build output (`result`, `_site/`, `site/`): CI builds the
 docs site, deck included, and deploys it to GitHub Pages
-(`.github/workflows/pages.yml`).
+(`.github/workflows/ci.yml`, the external-systems/pkgs org CI).
 
 The docs site this repo builds is also its tutorial: start with
 `documentation/docs/getting-started.md`, or run the preview and read it in
@@ -80,7 +80,7 @@ flake-parts/       consumer-facing modules, auto-imported: the template output
 dev/               dev partition: inputs (dev/flake.lock), formatter, checks, docs
 devenv.yaml        dev shell (devenv CLI), the org shell from external-systems/pkgs
 documentation/     flake-module.nix + MkDocs site (mkdocs.yml, docs/) + slides/ deck
-.github/workflows/ pages.yml: check, build and deploy the docs site to GitHub Pages
+.github/           ci.yml (org CI: check, Pages deploy, release) + rulesets/default.json
 .vscode/           nixd (Nix language server) settings
 ```
 

devenv.lock

@@ -53,6 +53,30 @@
         "type": "github"
       }
     },
+    "moscripts": {
+      "inputs": {
+        "nixpkgs": [
+          "org-pkgs",
+          "nixpkgs"
+        ],
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "systems": "systems",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1776608080,
+        "narHash": "sha256-4vVq0KIJe/no8+6RMDLFgc6PhbsKas45+vvJBzkKw7k=",
+        "rev": "c7b7977f4494fc1d48eada86d6f8e9174a74d0e1",
+        "revCount": 77,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/andrewthomaslee/moscripts/0.1.0/019da619-cbca-7990-81d0-6071370e1994/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/andrewthomaslee/moscripts/%2A"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1793110635,
@@ -73,20 +97,76 @@
       "inputs": {
         "flake-parts": "flake-parts",
         "import-tree": "import-tree",
-        "nixpkgs": "nixpkgs"
+        "moscripts": "moscripts",
+        "nixpkgs": "nixpkgs",
+        "zen-browser": "zen-browser"
       },
       "locked": {
-        "lastModified": 1793444658,
-        "narHash": "sha256-Fk+uJAmFS0FbZqH48EoqRifwiJM1Z1TlfX5f4hZS4/M=",
+        "lastModified": 1793666333,
+        "narHash": "sha256-mgGnU2A7gcLhPVu6gsMHJ4TqO5wHIDxV+6N9xbFfVE4=",
         "owner": "external-systems",
         "repo": "pkgs",
-        "rev": "e058d99fe9f04de4fc47ce892d0efbfebba7929b",
+        "rev": "c66adf4c5f91d4da541ff9d896c86eb5414886c3",
         "type": "github"
       },
       "original": {
         "owner": "external-systems",
         "repo": "pkgs",
-        "rev": "e058d99fe9f04de4fc47ce892d0efbfebba7929b",
+        "rev": "c66adf4c5f91d4da541ff9d896c86eb5414886c3",
+        "type": "github"
+      }
+    },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "org-pkgs",
+          "moscripts",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "org-pkgs",
+          "moscripts",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "org-pkgs",
+          "moscripts",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1756087852,
+        "narHash": "sha256-4jc3JDQt75fYXFrglgqyzF6C6zLU0QGLymzian4aP+U=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "6edb3ae27395cd88be3d64b732d1539957dad59c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "org-pkgs",
+          "moscripts",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1756395552,
+        "narHash": "sha256-5aJM14MpoLk2cdZAetu60OkLQrtFLWTICAyn1EP7ZpM=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "030dffc235dcf240d918c651c78dc5f158067b51",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
         "type": "github"
       }
     },
@@ -99,6 +179,69 @@
         ],
         "org-pkgs": "org-pkgs"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "org-pkgs",
+          "moscripts",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "org-pkgs",
+          "moscripts",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1756466761,
+        "narHash": "sha256-ALXRHIMXQ4qVNfCbcWykC23MjMwUoHn9BreoBfqmq0Y=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "0529e6d8227517205afcd1b37eee3088db745730",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
+    "zen-browser": {
+      "inputs": {
+        "nixpkgs": [
+          "org-pkgs",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1793356942,
+        "narHash": "sha256-3ddg7v2Ya11zEeQghXELyFwYIpv+nCTm2uVmu3LmvfU=",
+        "owner": "youwen5",
+        "repo": "zen-browser-flake",
+        "rev": "532b9a848c6b96d9f607e8856d1a458bdb7dcf66",
+        "type": "github"
+      },
+      "original": {
+        "owner": "youwen5",
+        "repo": "zen-browser-flake",
+        "type": "github"
+      }
     }
   },
   "root": "root",

devenv.yaml

@@ -6,7 +6,7 @@
 # pkgs ("attribute 'bash' missing").
 inputs:
   org-pkgs:
-    url: github:external-systems/pkgs/e058d99fe9f04de4fc47ce892d0efbfebba7929b
+    url: github:external-systems/pkgs/c66adf4c5f91d4da541ff9d896c86eb5414886c3
   nixpkgs:
     follows: org-pkgs/nixpkgs
 imports:

documentation/docs/getting-started.md

@@ -80,10 +80,12 @@ nix flake check     # builds both sites, lints, checks the lock files
 
 ## 6. Publish to GitHub Pages
 
-The repo ships `.github/workflows/pages.yml`. On every push to `main` it
-runs `nix flake check`, builds the docs site (slides included under
-`/slides/`) and deploys it to GitHub Pages. Pull requests run the same
-checks and build without deploying.
+The repo ships `.github/workflows/ci.yml`, which calls the
+external-systems org CI (`org-ci.yml` in external-systems/pkgs). Pull
+requests run `nix flake check` (the `ci / flake-check` status). On every
+push to `main` it also builds the docs site (slides included under
+`/slides/`), deploys it to GitHub Pages and tags a `0.<minor>.<commits>`
+release.
 
 Turn it on once per repo: **Settings → Pages → Build and deployment →
 Source: GitHub Actions**. The site then appears at